Re: Transfer-codings, mandatory content-coding support and intermediaries

On 21 April 2014 06:54, Albert Lunde <atlunde@panix.com> wrote:
> I doubt that most web browser clients have a security model
> that can reliably identify "potentially-attacker-supplied data"; too much of
> the content, including JavaScript _is_ potentially-attacker-supplied, and
> there are too many back doors from one context to another.

That's not true.  Web browser clients have very robust attribution
models.  We don't necessarily want to use those, because it's a fair
complexity burden.

The real problem here is less with clients, but servers.  The BEAST
demonstrations exploited servers that dynamically compressed content
without regard to the source of the compressed content.

Received on Monday, 21 April 2014 16:35:49 UTC